Ao Kaspersky Lab

Other

Vladimir V Krylov

Alexander V Liskin

Alexey E Antonov

Thierry Boudet

Emelian Gamarts

J&eacute;r&ocirc;me Fantini

Disclosed are systems and methods for training and retraining a model for detection of malicious activity from container files, which contain at least two or more objects constituting logically separate data regions. Parameters of each object chosen from at least one safe container and one malicious container are determined which uniquely characterize the functional relation of the mentioned object to at least one selected object. Convolutions are formed separately for each container on the basis of the determined parameters of the objects, which are used to train a machine learning model for detecting malicious container files.

System and method of training a machine learning model for detection of malicious containers

A system and method is provided for determining whether an electronic file is malicious. An exemplary method includes extracting resources from an electronic file; forming a first rule that establishes a functional dependency between the extracted resources; identifying, in a database of malicious file resources, a second rule associated with one or more of the extracted resources; comparing the formed first rule with the identified second rule to calculate a degree of similarity between first and second rules; and determining the electronic file to be a malicious file when the calculated degree of similarity exceeds a predetermined threshold value.

System and method of detecting malicious files with the use of elements of static analysis

Disclosed are systems and methods for emulating execution of a file based on emulation time. In one aspect, an exemplary method comprises, generating an image of a file, emulating an execution of instructions from the image for a predetermined emulation time, the emulation including: when an emulation of an execution of instruction from an image of another file is needed, generating an image of the another file, detecting known set of instructions in portions read from the image, inserting a break point into a position in the generated image corresponding to a start of the detected set of instructions, emulating execution of the another file by emulating execution of instructions from the generated image, and adding corresponding records to an emulation log, and reading a next portion from the image of the another file and repeating the emulation until the predetermined emulation time has elapsed.

System and method of emulating execution of files based on emulation time

Disclosed are systems and methods for detection of malicious intermediate language files. In one exemplary aspect, the system comprises a database comprising hashes of known malicious files, a resource allocation module configured to select a set of resources from a file being analyzed, a hash calculation module, coupled to the resource allocation module, configured to calculate a perceptive hash of the set of resources; and an analysis module, coupled to the other modules, configured to identify a degree of similarly between the set of resources and a set of resources from known malicious files by comparing the perceptive hash with perceptive hashes of the set of resources from known malicious files, determine a harmfulness of the file being analyzed based on the degree of similarity and remove or quarantine the file being analyzed when the harmfulness exceeds a predetermined threshold.

System and method of identifying a malicious intermediate language file

Disclosed are systems and methods for emulating execution of a file. An image of a file is formed, which is comprised of instructions read from the file. An analysis module detects at least one known set of instructions in a portion read from the file, and inserts a break point into a position in the generated image of the file corresponding to a start of the detected set of instructions. An emulation module emulates execution of the file by emulating execution of instructions from the generated image of the file and adding corresponding records to an emulation log associated with the emulated execution of the at least one known set of instructions.

System and method of emulating execution of files

The apparatus for detecting the presence of a particular gas within a mixture of gases comprises first and second emitter means for emitting measurement and reference electromagnetic radiation beams respectively, which beams are activated in alternation, a measurement cell, a filter cell, first and second detector means for detecting electromagnetic radiation beams, a beam splitter, and acquisition and processing means for synchronously acquiring and processing the four signals U , U , U , U delivered by the first and second detector means in succession when the first and second emitter means are respectively activated so as to determine the absolute concentration of the gas to be detected on the basis of the ratio R&equals;(U &times;U )/(U &times;U ) between the four signals, in which U and U respectively represent the signals delivered by the first and second detector means when the first emitter means is activated, and U and U respectively represent the signals delivered by the first and second detector means when the second emitter means is activated.

Growing community of inventors

Moscow, Russia

Vladimir V Krylov